fix: create profile for single-login-exempt users; add group exemption test

Exempt users returned early before UserProfile.objects.get_or_create,
so users without a profile never got one created on login while
PREVENT_CONCURRENT_LOGINS was enabled. Move the exemption check to
only skip set_login_session, and add coverage for SINGLE_LOGIN_EXEMPT_GROUPS
and for client1 remaining authenticated after a concurrent login.

Author: blarghmatey

common/djangoapps/student/models/user.py

@@ -1371,9 +1371,6 @@ def enforce_single_login(sender, request, user, signal, **kwargs):  # pylint: di
     to prevent concurrent logins.
     """
     if settings.FEATURES.get('PREVENT_CONCURRENT_LOGINS', False):
-        if user and _is_single_login_exempt(user):
-            # Shared service/automation accounts may hold concurrent sessions.
-            return
         if signal == user_logged_in:
             key = request.session.session_key
         else:
@@ -1383,7 +1380,8 @@ def enforce_single_login(sender, request, user, signal, **kwargs):  # pylint: di
                 user=user,
                 defaults={'name': user.username}
             )
-            if user_profile:
+            if user_profile and not _is_single_login_exempt(user):
+                # Shared service/automation accounts may hold concurrent sessions.
                 user.profile.set_login_session(key)
 
 

openedx/core/djangoapps/user_authn/views/tests/test_login.py

@@ -12,7 +12,7 @@
 
 import ddt
 from django.conf import settings
-from django.contrib.auth.models import User  # pylint: disable=imported-auth-user
+from django.contrib.auth.models import Group, User  # pylint: disable=imported-auth-user
 from django.core import mail
 from django.core.cache import cache
 from django.http import HttpResponse
@@ -682,6 +682,45 @@ def test_single_session_exempt_user(self):
             # session is ever deleted.
             assert 'session_id' not in self.user.profile.get_meta()
 
+            try:
+                # this test can be run with either lms or studio settings
+                # since studio does not have a dashboard url, we should
+                # look for another url that is login_required, in that case
+                url = reverse('dashboard')
+            except NoReverseMatch:
+                url = reverse('upload_transcripts')
+            response = client1.get(url)
+            # client1 remains authenticated; the exempt user's first session
+            # was not evicted by the second login.
+            assert response.status_code == 200
+
+    @patch.dict("django.conf.settings.FEATURES", {'PREVENT_CONCURRENT_LOGINS': True})
+    def test_single_session_exempt_group(self):
+        """
+        A user in a group listed in SINGLE_LOGIN_EXEMPT_GROUPS is not subject
+        to single-login enforcement: a concurrent login does not record the
+        single-session slot and therefore does not evict the first session.
+        """
+        group = Group.objects.create(name='exempt-service-accounts')
+        self.user.groups.add(group)
+
+        creds = {'email': self.user_email, 'password': self.password}
+        client1 = Client()
+        client2 = Client()
+
+        with override_settings(SINGLE_LOGIN_EXEMPT_GROUPS=[group.name]):
+            response = client1.post(self.url, creds)
+            self._assert_response(response, success=True)
+
+            # A second login must NOT evict the exempt user's first session.
+            response = client2.post(self.url, creds)
+            self._assert_response(response, success=True)
+
+            self.user = User.objects.get(pk=self.user.pk)
+            # No single-session slot is recorded for exempt users, so neither
+            # session is ever deleted.
+            assert 'session_id' not in self.user.profile.get_meta()
+
     @patch.dict("django.conf.settings.FEATURES", {'PREVENT_CONCURRENT_LOGINS': True})
     def test_single_session_with_no_user_profile(self):
         """